@vellumai/assistant 0.7.0 → 0.7.1

package/src/__tests__/heartbeat-service.test.ts

@@ -90,16 +90,74 @@ mock.module("../memory/conversation-crud.js", () => ({
   },
 }));
 
-// Mock logger
+// Mock logger — capture warn calls for unreachable-credential assertions
+const loggerWarnCalls: Array<Record<string, unknown>> = [];
 mock.module("../util/logger.js", () => ({
   getLogger: () => ({
     info: () => {},
     debug: () => {},
-    warn: () => {},
+    warn: (...args: unknown[]) => {
+      if (args.length > 0 && typeof args[0] === "object" && args[0] !== null) {
+        loggerWarnCalls.push(args[0] as Record<string, unknown>);
+      }
+    },
     error: () => {},
   }),
 }));
 
+// ── Credential health mock ──────────────────────────────────────────
+//
+// HeartbeatService dynamically imports `checkAllCredentials` inside
+// `runCredentialHealthCheck`, so `mock.module` intercepts it. Tests
+// mutate `mockCredentialHealthReport` to drive different scenarios.
+import type {
+  CredentialHealthReport,
+  CredentialHealthResult,
+  CredentialHealthStatus,
+} from "../credential-health/credential-health-service.js";
+
+let mockCredentialHealthReport: CredentialHealthReport | null = null;
+let mockCheckAllCredentialsFail = false;
+
+mock.module("../credential-health/credential-health-service.js", () => ({
+  checkAllCredentials: async () => {
+    if (mockCheckAllCredentialsFail) {
+      throw new Error("CES unreachable");
+    }
+    return (
+      mockCredentialHealthReport ?? {
+        checkedAt: Date.now(),
+        results: [],
+        unhealthy: [],
+      }
+    );
+  },
+}));
+
+// ── Notification signal mock ────────────────────────────────────────
+//
+// `notifyUnhealthyCredentials` dynamically imports `emitNotificationSignal`.
+// Track calls so tests can assert which credentials were notified about.
+const emittedNotificationSignals: Array<{
+  sourceContextId: string;
+  dedupeKey: string;
+  contextPayload: Record<string, unknown>;
+}> = [];
+
+mock.module("../notifications/emit-signal.js", () => ({
+  emitNotificationSignal: async (opts: {
+    sourceContextId: string;
+    dedupeKey: string;
+    contextPayload: Record<string, unknown>;
+  }) => {
+    emittedNotificationSignals.push({
+      sourceContextId: opts.sourceContextId,
+      dedupeKey: opts.dedupeKey,
+      contextPayload: opts.contextPayload,
+    });
+  },
+}));
+
 // Mock conversation title service
 mock.module("../memory/conversation-title-service.js", () => ({
   GENERATING_TITLE: "Generating title...",
@@ -108,16 +166,18 @@ mock.module("../memory/conversation-title-service.js", () => ({
 
 // Mock processMessage — HeartbeatService now imports it directly.
 // Tests override _testProcessMessage to capture / customize calls.
-let _testProcessMessage: ((...args: unknown[]) => Promise<{ messageId: string }>) | undefined;
+let _testProcessMessage:
+  | ((...args: unknown[]) => Promise<{ messageId: string }>)
+  | undefined;
 
 mock.module("../daemon/process-message.js", () => ({
   processMessage: async (...args: unknown[]) => {
     if (_testProcessMessage) return _testProcessMessage(...args);
     return { messageId: `mock-msg-${Date.now()}` };
   },
+  processMessageInBackground: async () => ({ messageId: "mock-bg" }),
   resolveTurnChannel: () => "vellum",
   resolveTurnInterface: () => "vellum",
-  makePendingInteractionRegistrar: () => () => {},
   prepareConversationForMessage: async () => ({}),
 }));
 
@@ -199,6 +259,10 @@ describe("HeartbeatService", () => {
     createdConversations.length = 0;
     conversationIdCounter = 0;
     mockGuardianPersona = null;
+    mockCredentialHealthReport = null;
+    mockCheckAllCredentialsFail = false;
+    emittedNotificationSignals.length = 0;
+    loggerWarnCalls.length = 0;
 
     // Default processMessage mock: capture calls for assertions.
     setTestProcessMessage(async (...args: unknown[]) => {
@@ -221,9 +285,7 @@ describe("HeartbeatService", () => {
   });
 
   function createService(overrides?: {
-    processMessage?: (
-      ...args: unknown[]
-    ) => Promise<{ messageId: string }>;
+    processMessage?: (...args: unknown[]) => Promise<{ messageId: string }>;
     getCurrentHour?: () => number;
   }) {
     if (overrides?.processMessage) {
@@ -771,4 +833,224 @@ describe("HeartbeatService", () => {
       expect(prompt).toContain("google, slack");
     });
   });
+
+  describe("transient credential health suppression", () => {
+    function makeUnhealthyResult(
+      overrides: Partial<CredentialHealthResult> = {},
+    ): CredentialHealthResult {
+      return {
+        connectionId: overrides.connectionId ?? "conn-1",
+        provider: overrides.provider ?? "google",
+        accountInfo: overrides.accountInfo ?? "user@example.com",
+        status: overrides.status ?? ("missing_token" as CredentialHealthStatus),
+        details: overrides.details ?? "Token not found",
+        missingScopes: overrides.missingScopes ?? [],
+        canAutoRecover: overrides.canAutoRecover ?? false,
+      };
+    }
+
+    test("unreachable credentials do not trigger notifications", async () => {
+      mockCredentialHealthReport = {
+        checkedAt: Date.now(),
+        results: [
+          makeUnhealthyResult({
+            connectionId: "conn-google",
+            provider: "google",
+            status: "unreachable",
+            details: "CES backend unavailable",
+          }),
+        ],
+        unhealthy: [
+          makeUnhealthyResult({
+            connectionId: "conn-google",
+            provider: "google",
+            status: "unreachable",
+            details: "CES backend unavailable",
+          }),
+        ],
+      };
+
+      const service = createService();
+      await service.runOnce();
+
+      // No notification signals should have been emitted for unreachable
+      expect(emittedNotificationSignals).toHaveLength(0);
+    });
+
+    test("unreachable credentials do not block provider tools in heartbeat prompt", async () => {
+      mockCredentialHealthReport = {
+        checkedAt: Date.now(),
+        results: [
+          makeUnhealthyResult({
+            connectionId: "conn-google",
+            provider: "google",
+            status: "unreachable",
+            details: "CES backend unavailable",
+          }),
+        ],
+        unhealthy: [
+          makeUnhealthyResult({
+            connectionId: "conn-google",
+            provider: "google",
+            status: "unreachable",
+            details: "CES backend unavailable",
+          }),
+        ],
+      };
+
+      const service = createService();
+      await service.runOnce();
+
+      // The prompt should NOT contain <credential-status> since unreachable
+      // is not a hard failure and should not tell the LLM to skip providers
+      expect(processMessageCalls).toHaveLength(1);
+      expect(processMessageCalls[0].content).not.toContain(
+        "<credential-status>",
+      );
+    });
+
+    test("unreachable credentials log a warning", async () => {
+      mockCredentialHealthReport = {
+        checkedAt: Date.now(),
+        results: [
+          makeUnhealthyResult({
+            connectionId: "conn-google",
+            provider: "google",
+            status: "unreachable",
+            details: "CES backend unavailable",
+          }),
+        ],
+        unhealthy: [
+          makeUnhealthyResult({
+            connectionId: "conn-google",
+            provider: "google",
+            status: "unreachable",
+            details: "CES backend unavailable",
+          }),
+        ],
+      };
+
+      const service = createService();
+      await service.runOnce();
+
+      // Logger warn should have been called with unreachableCount
+      const unreachableWarns = loggerWarnCalls.filter(
+        (call) => "unreachableCount" in call,
+      );
+      expect(unreachableWarns).toHaveLength(1);
+      expect(unreachableWarns[0].unreachableCount).toBe(1);
+    });
+
+    test("missing_token still notifies and blocks provider tools", async () => {
+      mockCredentialHealthReport = {
+        checkedAt: Date.now(),
+        results: [
+          makeUnhealthyResult({
+            connectionId: "conn-google",
+            provider: "google",
+            status: "missing_token",
+            details: "Token not found in keychain",
+          }),
+        ],
+        unhealthy: [
+          makeUnhealthyResult({
+            connectionId: "conn-google",
+            provider: "google",
+            status: "missing_token",
+            details: "Token not found in keychain",
+          }),
+        ],
+      };
+
+      const service = createService();
+      await service.runOnce();
+
+      // Should have emitted a notification for missing_token
+      expect(emittedNotificationSignals).toHaveLength(1);
+      expect(emittedNotificationSignals[0].contextPayload.status).toBe(
+        "missing_token",
+      );
+      expect(emittedNotificationSignals[0].contextPayload.provider).toBe(
+        "google",
+      );
+
+      // Prompt should include <credential-status> blocking google
+      expect(processMessageCalls).toHaveLength(1);
+      expect(processMessageCalls[0].content).toContain("<credential-status>");
+      expect(processMessageCalls[0].content).toContain("google");
+    });
+
+    test("mixed report notifies only actionable failures, not unreachable", async () => {
+      mockCredentialHealthReport = {
+        checkedAt: Date.now(),
+        results: [
+          makeUnhealthyResult({
+            connectionId: "conn-google",
+            provider: "google",
+            status: "unreachable",
+            details: "CES backend unavailable",
+          }),
+          makeUnhealthyResult({
+            connectionId: "conn-slack",
+            provider: "slack",
+            status: "revoked",
+            details: "Token was revoked by user",
+          }),
+          makeUnhealthyResult({
+            connectionId: "conn-github",
+            provider: "github",
+            status: "unreachable",
+            details: "CES backend unavailable",
+          }),
+        ],
+        unhealthy: [
+          makeUnhealthyResult({
+            connectionId: "conn-google",
+            provider: "google",
+            status: "unreachable",
+            details: "CES backend unavailable",
+          }),
+          makeUnhealthyResult({
+            connectionId: "conn-slack",
+            provider: "slack",
+            status: "revoked",
+            details: "Token was revoked by user",
+          }),
+          makeUnhealthyResult({
+            connectionId: "conn-github",
+            provider: "github",
+            status: "unreachable",
+            details: "CES backend unavailable",
+          }),
+        ],
+      };
+
+      const service = createService();
+      await service.runOnce();
+
+      // Only the revoked credential should trigger a notification
+      expect(emittedNotificationSignals).toHaveLength(1);
+      expect(emittedNotificationSignals[0].contextPayload.provider).toBe(
+        "slack",
+      );
+      expect(emittedNotificationSignals[0].contextPayload.status).toBe(
+        "revoked",
+      );
+
+      // Only slack (revoked = hard failure) should appear in credential-status
+      expect(processMessageCalls).toHaveLength(1);
+      expect(processMessageCalls[0].content).toContain("<credential-status>");
+      expect(processMessageCalls[0].content).toContain("slack");
+      // google and github are unreachable — should NOT be in credential-status
+      expect(processMessageCalls[0].content).not.toContain("google");
+      expect(processMessageCalls[0].content).not.toContain("github");
+
+      // Should have logged a warning about the 2 unreachable credentials
+      const unreachableWarns = loggerWarnCalls.filter(
+        (call) => "unreachableCount" in call,
+      );
+      expect(unreachableWarns).toHaveLength(1);
+      expect(unreachableWarns[0].unreachableCount).toBe(2);
+    });
+  });
 });

package/src/__tests__/helpers/channel-test-adapter.ts

@@ -47,12 +47,13 @@ export function setAdapterProcessMessage(
 mock.module("../../daemon/process-message.js", () => ({
   resolveTurnChannel: () => "telegram",
   resolveTurnInterface: () => "telegram",
-  makePendingInteractionRegistrar: () => () => {},
+
   prepareConversationForMessage: async () => ({}),
   processMessage: (...args: unknown[]) => {
     if (_adapterProcessMessage) return _adapterProcessMessage(...args);
     return Promise.resolve({ messageId: `mock-msg-adapter-${Date.now()}` });
   },
+  processMessageInBackground: async () => ({ messageId: "mock-bg" }),
 }));
 
 mock.module("../../daemon/approval-generators.js", () => ({
@@ -158,4 +159,3 @@ export async function handleReplayDeadLetters(req: Request): Promise<Response> {
   const body = await req.json();
   return wrapHandler(() => _handleReplayDeadLetters({ body }));
 }
-

package/src/__tests__/helpers/create-guardian-binding.ts

@@ -0,0 +1,91 @@
+/**
+ * Test-only helper to create a guardian binding by writing directly to the
+ * contacts DB. Extracted from contacts-write.ts after the production code
+ * path was moved to the gateway.
+ */
+
+import type { ChannelId } from "../../channels/types.js";
+import { upsertContact } from "../../contacts/contact-store.js";
+import type { GuardianBinding } from "../../memory/channel-verification-sessions.js";
+import { ensureGuardianPersonaFile } from "../../prompts/persona-resolver.js";
+import { canonicalizeInboundIdentity } from "../../util/canonicalize-identity.js";
+
+function parseDisplayNameFromMetadata(
+  metadataJson: string | null | undefined,
+): string | null {
+  if (!metadataJson) return null;
+  try {
+    const parsed = JSON.parse(metadataJson);
+    if (
+      typeof parsed.displayName === "string" &&
+      parsed.displayName.length > 0
+    ) {
+      return parsed.displayName;
+    }
+  } catch {
+    // Malformed JSON — fall through
+  }
+  return null;
+}
+
+export function createGuardianBinding(params: {
+  channel: string;
+  guardianExternalUserId: string;
+  guardianDeliveryChatId: string;
+  guardianPrincipalId: string;
+  verifiedVia?: string;
+  metadataJson?: string | null;
+}): GuardianBinding {
+  const canonicalId =
+    canonicalizeInboundIdentity(
+      params.channel as ChannelId,
+      params.guardianExternalUserId,
+    ) ?? params.guardianExternalUserId;
+
+  const displayName =
+    parseDisplayNameFromMetadata(params.metadataJson) ??
+    params.guardianExternalUserId;
+
+  const contact = upsertContact({
+    displayName,
+    role: "guardian",
+    notes: "guardian",
+    principalId: params.guardianPrincipalId,
+    channels: [
+      {
+        type: params.channel,
+        address: canonicalId,
+        externalUserId: canonicalId,
+        externalChatId: params.guardianDeliveryChatId,
+        status: "active",
+        verifiedAt: Date.now(),
+        verifiedVia: params.verifiedVia ?? "challenge",
+      },
+    ],
+  });
+
+  // Seed persona file (mirrors gateway's production behavior)
+  if (contact.userFile) {
+    try {
+      ensureGuardianPersonaFile(contact.userFile);
+    } catch {
+      // Tolerate filesystem failures in tests
+    }
+  }
+
+  const now = Date.now();
+  return {
+    id: `contact-binding-${params.channel}`,
+    assistantId: "self",
+    channel: params.channel,
+    guardianExternalUserId: params.guardianExternalUserId,
+    guardianDeliveryChatId: params.guardianDeliveryChatId,
+    guardianPrincipalId: params.guardianPrincipalId,
+    status: "active",
+    verifiedAt: now,
+    verifiedVia: params.verifiedVia ?? "challenge",
+    metadataJson: params.metadataJson ?? null,
+    createdAt: now,
+    updatedAt: now,
+  };
+}